CVE-2026-41454

High

Description

WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform administrative actions without proper privilege verification. Attackers can enumerate integrations including webhook URLs, create new integrations, modify or delete existing integrations, and manage integration activities by exploiting insufficient authorization checks in the JsonRoutes REST handlers.

SeverityHigh

CVSS8.3

Exploit probability—

ProductWekan

PublishedApr 22, 2026

First seenApr 22, 2026

Weakness typeCWE-862Missing authorization

How to fix

Update

wekan wekan8.35.0 or later

Patches

github.com/wekan/wekan/commit/2cd702f48df2b8aef0e7381685f8e089986a18a4

Vendor advisories

github.com/wekan/wekan/releases/tag/v8.35

Affected products

Product	Affected versions	Fixed in
wekan wekan	v < 8.35.0	8.35.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.